Failure detecting apparatus and failure detecting method using patterns indicating occurrences of failures

Abstract

A failure detecting apparatus has a storage unit that stores patterns, indicating occurrences of failures, of messages. The failure detecting apparatus executes a process that includes identifying, when a new message is output from a target to be monitored, a message to be replaced, which is output from the target to be monitored before the output of the new message and is not output from the target to be monitored after the output of the new message, extracting a pattern including the message to be replaced from the storage unit, registering a pattern resulting from substitution of the message to be replaced included in the extracted pattern in the storage unit with the new message, and detecting whether or not messages output from the target to be monitored include any of the patterns stored in the storage unit.

What is claimed is: 
     
       1. A failure detecting apparatus comprising:
 a processor that executes a process comprising: 
 identifying, when a new message is output from a target to be monitored, a message to be replaced, which is output from the target to be monitored before the output of the new message and is not output from the target to be monitored after the output of the new message; 
 extracting a pattern including the message to be replaced, from patterns of messages stored in a storage unit, the patterns indicating occurrences of failures, and registering, in the storage unit, a pattern resulting from substitution of the message to be replaced included in the extracted pattern with the new message; and 
 detecting whether or not messages output from the target to be monitored include any of the patterns stored in the storage unit. 
 
     
     
       2. The failure detecting apparatus according to  claim 1 , wherein the identifying includes identifying the message to be replaced, based on an average occurrence interval and a period from a last occurrence, of each message. 
     
     
       3. The failure detecting apparatus according to  claim 2 , wherein the identifying includes finding a similarity between messages that occur in a predetermined period around an occurrence of the message to be replaced and messages that occur in a predetermined period around an occurrence of the new message, and identifying a message to be replaced with a high similarity. 
     
     
       4. The failure detecting apparatus according to  claim 1 , wherein
 the storage unit stores therein a number of occurrences and a number of failure occurrences, for each of the patterns, 
 the registering includes copying the number of occurrences and the number of failure occurrences of the extracted pattern and registering the copied number of occurrences and number of failure occurrences of the extracted pattern corresponding with the substituted pattern in the storage unit, and 
 the process further comprises notifying a probability of occurrence of failure from the number of occurrences and the number of failure occurrences for a detected pattern. 
 
     
     
       5. The failure detecting apparatus according to  claim 4 , wherein when the registered pattern does not include any other new message, the registering includes copying the number of occurrences and the number of failure occurrences of the extracted pattern, and when the registered pattern includes any other new message, the registering includes copying the number of occurrences and the number of failure occurrences of the registered pattern. 
     
     
       6. The failure detecting apparatus according to  claim 5 , the process further comprising deleting the registered pattern when a probability of occurrence of failure for the registered pattern is less than a probability of occurrence of failure for the extracted pattern by a predetermined value or more. 
     
     
       7. A non-transitory computer-readable recording medium having stored therein a program for causing a computer to execute a process, the process comprising:
 identifying, when a new message is output from a target to be monitored, a message to be replaced, which is output from the target to be monitored before the output of the new message and is not output from the target to be monitored after the output of the new message; 
 extracting a pattern including the message to be replaced, from patterns of messages stored in a storage unit, the patterns indicating occurrences of failures, and registering, in the storage unit, a pattern resulting from substitution of the message to be replaced included in the extracted pattern with the new message; and 
 detecting whether or not messages output from the target to be monitored include any of the patterns stored in the storage unit. 
 
     
     
       8. A failure detecting method comprising:
 identifying, using a processor, when a new message is output from a target to be monitored, a message to be replaced, which is output from the target to be monitored before the output of the new message and is not output from the target to be monitored after the output of the new message; 
 extracting, using a processor, a pattern including the message to be replaced, from patterns of messages stored in a storage unit, the patterns indicating occurrences of failures, and registering, in the storage unit, a pattern resulting from substitution of the message to be replaced included in the extracted pattern with the new message; and 
 detecting, using a processor, whether or not messages output from the target to be monitored include any of the patterns stored in the storage unit.